mSecure Advises Password, 2FA and Passkey Changes After Alert
mSecure password manager customers have been urged to consider changing passwords, resetting two-factor authentication (2FA) and removing passkeys after suspicious activity associated with the app. The warning was sent by developer mSeven Software on November 3 to current and former mSecure customers.
The company did not describe the activity, identify the systems involved, state whether customer vault data was exposed or say when the activity occurred. It also did not disclose how many people received the notification or confirm whether the activity had ended.
Limited details on the incident
In its email, mSeven said it had opened an investigation, taken steps to limit the issue and engaged external cybersecurity experts. The notice presents its security recommendations as possible actions rather than a mandatory sequence, leaving customers without guidance on which accounts should be addressed first or how each reset should be completed.
As of 18:00 UTC on November 3, mSeven had not posted a public notice about the email on mSecure's X or Facebook accounts. A copy of the email was posted by a recipient in an mSecure support forum thread, where no staff response had appeared by that time.
What may be stored in mSecure
mSecure can synchronise a customer's vault through mSecure Cloud, Dropbox, iCloud or Wi-Fi. The email does not say whether the suspicious activity affects one or more of those synchronisation methods, or whether customers using a particular option face a different risk.
mSecure 7 can hold passkeys and 2FA codes alongside passwords for customers on the Essentials plan and higher. The warning does not clarify whether its references to resetting 2FA and removing passkeys concern items stored in the vault, the mSecure account sign-in process, or both.
mSecure says that vault information is encrypted on the customer's device before synchronisation and that its developers cannot access customer information. However, Germany's Federal Office for Information Security (BSI) reported in a December 2025 study that mSeven could theoretically access stored data in mSecure 6.1.5 for Android. The BSI assessed only that release, so its finding may not apply to subsequent versions.
Steps for account owners
The notification does not say whether suspicious activity reached vault contents or the cryptographic keys protecting them. It also does not tell customers whether they should continue using mSecure to store replacement passwords. On November 3, the newest iPhone release listed in Apple's App Store was mSecure 7.1.0, released on October 23.
For businesses and individual account owners, the immediate implication is to identify the most sensitive credentials and authentication methods held in mSecure, plan changes in a priority order, and preserve access to account recovery channels while the investigation continues.